From 655da1de76433300ad7552ed99c00818869cb1fb Mon Sep 17 00:00:00 2001
From: Greyson Parrelli <greyson@signal.org>
Date: Fri, 24 Jan 2025 10:56:37 -0500
Subject: [PATCH] Validate sticker IDs during export.

---
 .../backup/v2/exporters/ChatItemArchiveExporter.kt        | 8 ++++----
 .../backup/v2/processor/StickerArchiveProcessor.kt        | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/app/src/main/java/org/thoughtcrime/securesms/backup/v2/exporters/ChatItemArchiveExporter.kt b/app/src/main/java/org/thoughtcrime/securesms/backup/v2/exporters/ChatItemArchiveExporter.kt
index 0d383b51b4..c34555c180 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/backup/v2/exporters/ChatItemArchiveExporter.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/backup/v2/exporters/ChatItemArchiveExporter.kt
@@ -983,16 +983,16 @@ private fun DatabaseAttachment.toRemoteStickerMessage(sentTimestamp: Long, media
   val stickerLocator = this.stickerLocator!!
 
   val packId = try {
-    Hex.fromStringCondensed(stickerLocator.packId)
+    Hex.fromStringCondensed(stickerLocator.packId).takeIf { it.size == 16 } ?: throw IOException("Incorrect length!")
   } catch (e: IOException) {
-    Log.w(TAG, ExportSkips.invalidChatItemStickerPackId(sentTimestamp))
+    Log.w(TAG, ExportSkips.invalidChatItemStickerPackId(sentTimestamp), e)
     return null
   }
 
   val packKey = try {
-    Hex.fromStringCondensed(stickerLocator.packKey)
+    Hex.fromStringCondensed(stickerLocator.packKey).takeIf { it.size == 32 } ?: throw IOException("Incorrect length!")
   } catch (e: IOException) {
-    Log.w(TAG, ExportSkips.invalidChatItemStickerPackKey(sentTimestamp))
+    Log.w(TAG, ExportSkips.invalidChatItemStickerPackKey(sentTimestamp), e)
     return null
   }
 
diff --git a/app/src/main/java/org/thoughtcrime/securesms/backup/v2/processor/StickerArchiveProcessor.kt b/app/src/main/java/org/thoughtcrime/securesms/backup/v2/processor/StickerArchiveProcessor.kt
index 48689feaaf..7cef9e24ab 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/backup/v2/processor/StickerArchiveProcessor.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/backup/v2/processor/StickerArchiveProcessor.kt
@@ -68,14 +68,14 @@ object StickerArchiveProcessor {
 
 private fun StickerPackRecord.toBackupFrame(): Frame? {
   val packIdBytes = try {
-    Hex.fromStringCondensed(this.packId)
+    Hex.fromStringCondensed(this.packId)?.takeIf { it.size == 16 } ?: throw IOException("Incorrect length!")
   } catch (e: IOException) {
     Log.w(TAG, ExportSkips.invalidStickerPackId())
     return null
   }
 
   val packKeyBytes = try {
-    Hex.fromStringCondensed(this.packKey)
+    Hex.fromStringCondensed(this.packKey)?.takeIf { it.size == 32 } ?: throw IOException("Incorrect length!")
   } catch (e: IOException) {
     Log.w(TAG, ExportSkips.invalidStickerPackKey())
     return null